SSL / TLS audit

What it does: fetches the live TLS certificate and audits the connection — subject/issuer, validity dates and days remaining, the negotiated TLS protocol and cipher suite, key size, signature algorithm, SANs, and SHA-256/SHA-1 thumbprints. It flags weak/expiring configurations as ⚠ findings (expired or <30 days, pre-TLS-1.2, SHA-1/MD5 signature, RSA <2048, self-signed) and remembers each host's certificate so it can warn you when the cert CHANGES since you last looked.

Tip: add :port for non-443 services, e.g. mail.example.com:993.

Safe to run: yes — it accepts any certificate so it can inspect broken/expired/self-signed ones without connecting as a real client. Read-only.

Reading results: "days remaining" near zero is a classic "it broke and nobody changed anything" outage. A "cert CHANGED since last seen" flag means the certificate was reissued/rotated — or, rarely, the connection is being intercepted; confirm the change was expected.